<html>
<head><meta charset="utf-8"><title>non-local goto and Pin / https://github.com/rust-lang/rfc... · t-lang/wg-unsafe-code-guidelines · Zulip Chat Archive</title></head>
<h2>Stream: <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/index.html">t-lang/wg-unsafe-code-guidelines</a></h2>
<h3>Topic: <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html">non-local goto and Pin / https://github.com/rust-lang/rfc...</a></h3>

<hr>

<base href="https://rust-lang.zulipchat.com">

<head><link href="https://rust-lang.github.io/zulip_archive/style.css" rel="stylesheet"></head>

<a name="158800105"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/158800105" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#158800105">(Feb 18 2019 at 13:34)</a>:</h4>
<p><span class="user-mention" data-user-id="120791">@RalfJ</span> I mentioned Pin in the last commit, but I guess my question was whether not jumping over Pin is a safety or validity invariant of Pin</p>



<a name="158800142"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/158800142" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#158800142">(Feb 18 2019 at 13:35)</a>:</h4>
<p>*jumping, and deallocating Pin's memory without dropping the Pin</p>



<a name="158800309"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/158800309" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#158800309">(Feb 18 2019 at 13:37)</a>:</h4>
<p>IIUC the issue is that safe Rust guarantees that freeing the memory of a Drop type will run its destructor</p>



<a name="158800378"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/158800378" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#158800378">(Feb 18 2019 at 13:38)</a>:</h4>
<p>it's a safety thing</p>



<a name="158800389"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/158800389" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#158800389">(Feb 18 2019 at 13:38)</a>:</h4>
<p>an incorrect non-local jump can break this guarantee, and if it does, the behavior is undefined</p>



<a name="158800410"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/158800410" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#158800410">(Feb 18 2019 at 13:39)</a>:</h4>
<p>but that's the case independently of whether you jump over a Pin or some other type</p>



<a name="158800419"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/158800419" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#158800419">(Feb 18 2019 at 13:39)</a>:</h4>
<blockquote>
<p>IIUC the issue is that safe Rust guarantees that freeing the memory of a Drop type will run its destructor</p>
</blockquote>
<p>well, not really. You can do e.g. <code>fn free_box_without_drop(x: Box&lt;T&gt;) { mem::forget(*x) }</code></p>



<a name="158800442"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/158800442" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#158800442">(Feb 18 2019 at 13:39)</a>:</h4>
<p>the problem with Pin is that if drop is not called you can get an use-after-free right?</p>



<a name="158800507"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/158800507" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#158800507">(Feb 18 2019 at 13:40)</a>:</h4>
<p>e.g. if some future is running in an executor in a different thread, and tries to read the memory behind the Pin which was deallocated</p>



<a name="158800539"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/158800539" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#158800539">(Feb 18 2019 at 13:41)</a>:</h4>
<p>uh, no. futures don't need this guarantee.</p>



<a name="158800547"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/158800547" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#158800547">(Feb 18 2019 at 13:41)</a>:</h4>
<blockquote>
<p>well, not really. You can do e.g. <code>fn free_box_without_drop(x: Box&lt;T&gt;) { mem::forget(*x) }</code></p>
</blockquote>



<a name="158800548"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/158800548" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#158800548">(Feb 18 2019 at 13:41)</a>:</h4>
<p>so what's the fundamental thing that non-local goto's break that Pin relies on ?</p>



<a name="158800549"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/158800549" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#158800549">(Feb 18 2019 at 13:41)</a>:</h4>
<p>the guarantee is relevant for intrusive collections</p>



<a name="158800559"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/158800559" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#158800559">(Feb 18 2019 at 13:41)</a>:</h4>
<p>and that my Pin-like library couldn't make use of ?</p>



<a name="158800566"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/158800566" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#158800566">(Feb 18 2019 at 13:41)</a>:</h4>
<p>(sorry i'm in an ICE and WLAN sucks)</p>



<a name="158800583"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/158800583" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#158800583">(Feb 18 2019 at 13:41)</a>:</h4>
<blockquote>
<p>so what's the fundamental thing that non-local goto's break that Pin relies on ?</p>
</blockquote>
<p><a href="https://www.ralfj.de/blog/2018/04/10/safe-intrusive-collections-with-pinning.html" target="_blank" title="https://www.ralfj.de/blog/2018/04/10/safe-intrusive-collections-with-pinning.html">https://www.ralfj.de/blog/2018/04/10/safe-intrusive-collections-with-pinning.html</a></p>



<a name="158800657"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/158800657" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#158800657">(Feb 18 2019 at 13:42)</a>:</h4>
<blockquote>
<p>and that my Pin-like library couldn't make use of ?</p>
</blockquote>
<p>well I suppose now that we blessed <code>Pin</code> other libs can do similar things</p>



<a name="158800668"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/158800668" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#158800668">(Feb 18 2019 at 13:43)</a>:</h4>
<p>but before <code>Pin</code> there just was no (blessed) type that relied on things like this</p>



<a name="158800686"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/158800686" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#158800686">(Feb 18 2019 at 13:43)</a>:</h4>
<p>But Pin's safety invariant is just a doc comment AFAICT</p>



<a name="158800690"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/158800690" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#158800690">(Feb 18 2019 at 13:43)</a>:</h4>
<p>so what?</p>



<a name="158800694"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/158800694" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#158800694">(Feb 18 2019 at 13:43)</a>:</h4>
<p>this is abozut the semantic meaning of types</p>



<a name="158800697"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/158800697" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#158800697">(Feb 18 2019 at 13:43)</a>:</h4>
<p>the compiler doesn't understand these</p>



<a name="158800701"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/158800701" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#158800701">(Feb 18 2019 at 13:43)</a>:</h4>
<p>but still they are relevant when building safe abstractions</p>



<a name="158800761"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/158800761" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#158800761">(Feb 18 2019 at 13:44)</a>:</h4>
<p>it assumes that safe Rust code can't do non-local jumps and that is still true</p>



<a name="158800762"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/158800762" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#158800762">(Feb 18 2019 at 13:44)</a>:</h4>
<p>sure, my point is just that Pin isn't special</p>



<a name="158800769"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/158800769" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#158800769">(Feb 18 2019 at 13:44)</a>:</h4>
<p>it's just like leakpocalpyse. the safety invariants involved here were all just doc comments, and yet we got UB -- from compsotion of several libraries that were safe in isolation.</p>



<a name="158800792"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/158800792" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#158800792">(Feb 18 2019 at 13:45)</a>:</h4>
<blockquote>
<p>sure, my point is just that Pin isn't special</p>
</blockquote>
<p>well, it is and it isn't. when two libraries are mutually incompatible, which one is special?</p>



<a name="158800817"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/158800817" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#158800817">(Feb 18 2019 at 13:45)</a>:</h4>
<p>a non-local jump over a Drop type is UB, independently of whether Pin exists or not</p>



<a name="158800821"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/158800821" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#158800821">(Feb 18 2019 at 13:45)</a>:</h4>
<p>like, you could kick out <code>Pin</code> and have some kind of safe closure-based interface for setjmp/longjmp</p>



<a name="158800827"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/158800827" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#158800827">(Feb 18 2019 at 13:45)</a>:</h4>
<p>no it isnt</p>



<a name="158800836"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/158800836" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#158800836">(Feb 18 2019 at 13:45)</a>:</h4>
<p>that's just <code>mem::forget</code> of a stack frame, basically</p>



<a name="158800902"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/158800902" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#158800902">(Feb 18 2019 at 13:46)</a>:</h4>
<p>the thing is that you cannot <code>mem::forget</code> the <em>content</em> of a <code>Pin&lt;Box&lt;T&gt;&gt;</code></p>



<a name="158800913"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/158800913" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#158800913">(Feb 18 2019 at 13:46)</a>:</h4>
<p>and you cannot <code>mem::forget</code> something that got pinned to the stack using pin-utils either</p>



<a name="158800965"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/158800965" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#158800965">(Feb 18 2019 at 13:47)</a>:</h4>
<p>ah because you can move out of the <code>Box</code> but you can't move out of the <code>Pin&lt;Box&gt;</code></p>



<a name="158801028"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/158801028" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#158801028">(Feb 18 2019 at 13:48)</a>:</h4>
<p>but you can do that with unsafe code, and the non-local jump allows you to do that with unsafe code as well</p>



<a name="158801032"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/158801032" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#158801032">(Feb 18 2019 at 13:48)</a>:</h4>
<p>so in a sense, <code>Pin</code> is special -- just as special as <code>Rc</code></p>



<a name="158801036"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/158801036" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#158801036">(Feb 18 2019 at 13:48)</a>:</h4>
<p>they both are blessed safe APIs that restrict what other safe APIs may do</p>



<a name="158801042"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/158801042" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#158801042">(Feb 18 2019 at 13:48)</a>:</h4>
<p>even though the compiler knows nothing about either of them</p>



<a name="158801067"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/158801067" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#158801067">(Feb 18 2019 at 13:49)</a>:</h4>
<blockquote>
<p>they both are blessed safe APIs that restrict what other safe APIs may do</p>
</blockquote>
<p>sorry, "do" was the wrong term here.<br>
they restrict what other safe APIs may <em>assume about unknown safe code</em>.</p>



<a name="158801072"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/158801072" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#158801072">(Feb 18 2019 at 13:49)</a>:</h4>
<p>and that is the key point</p>



<a name="158801081"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/158801081" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#158801081">(Feb 18 2019 at 13:49)</a>:</h4>
<p>so the question is whether you can create a safe wrapper over non-local jumps that works even if Pin exists?</p>



<a name="158801095"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/158801095" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#158801095">(Feb 18 2019 at 13:49)</a>:</h4>
<p>I don't think you can, as you have to rule out stack-pinned variables</p>



<a name="158801100"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/158801100" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#158801100">(Feb 18 2019 at 13:49)</a>:</h4>
<p>on the stack frames you are killing</p>



<a name="158801179"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/158801179" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#158801179">(Feb 18 2019 at 13:50)</a>:</h4>
<p>but if e.g. we decided that stack pinning wasnt possible, we could have a safe wrapper for such non-local jumps</p>



<a name="158801180"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/158801180" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#158801180">(Feb 18 2019 at 13:50)</a>:</h4>
<p>yeah, a stack frame with pinned variables is "pinned" as well, in some sense</p>



<a name="158801185"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/158801185" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#158801185">(Feb 18 2019 at 13:50)</a>:</h4>
<p>exactly</p>



<a name="158801215"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/158801215" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#158801215">(Feb 18 2019 at 13:50)</a>:</h4>
<p>there are many other issues that make writing a safe wrapper for such non-local jumps probably impossible</p>



<a name="158801229"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/158801229" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#158801229">(Feb 18 2019 at 13:51)</a>:</h4>
<p>so even if Pin would not exist, that would at least be very hard</p>



<a name="158801231"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/158801231" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#158801231">(Feb 18 2019 at 13:51)</a>:</h4>
<p>are you sure? the rest you mention seem solvable to me</p>



<a name="158801238"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/158801238" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#158801238">(Feb 18 2019 at 13:51)</a>:</h4>
<p>with a closure-based API in the style of call/cc + lifetimes to control scopding</p>



<a name="158801256"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/158801256" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#158801256">(Feb 18 2019 at 13:51)</a>:</h4>
<p>you can't allow non-volatile reads and stores between the setjmp and longjmp, you can't call longjump from a different thread</p>



<a name="158801261"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/158801261" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#158801261">(Feb 18 2019 at 13:51)</a>:</h4>
<p>and non-<code>Send</code> types to make sure the "handle" stays in the same thread</p>



<a name="158801267"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/158801267" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#158801267">(Feb 18 2019 at 13:51)</a>:</h4>
<p>ah right you mentioned those stores, I dont understand why they are necessary</p>



<a name="158801325"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/158801325" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#158801325">(Feb 18 2019 at 13:52)</a>:</h4>
<p>that would mean that you can't create new send types within the closure</p>



<a name="158801341"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/158801341" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#158801341">(Feb 18 2019 at 13:52)</a>:</h4>
<p>nono the handle gets passed in as an extra argument</p>



<a name="158801343"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/158801343" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#158801343">(Feb 18 2019 at 13:52)</a>:</h4>
<p>just make that non-<code>Send</code></p>



<a name="158801381"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/158801381" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#158801381">(Feb 18 2019 at 13:53)</a>:</h4>
<p>ah just like crossbeam scope ?</p>



<a name="158801387"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/158801387" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#158801387">(Feb 18 2019 at 13:53)</a>:</h4>
<p>yeah sth like that</p>



<a name="158801403"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/158801403" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#158801403">(Feb 18 2019 at 13:53)</a>:</h4>
<p>if you can only longjmp back from the handle, then that problem is solvable</p>



<a name="158801450"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/158801450" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#158801450">(Feb 18 2019 at 13:54)</a>:</h4>
<p>so why do all laods/stores need to be volatile? that's weird</p>



<a name="158801465"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/158801465" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#158801465">(Feb 18 2019 at 13:54)</a>:</h4>
<p>basically because the C standard says so and that's what LLVM implements</p>



<a name="158801476"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/158801476" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#158801476">(Feb 18 2019 at 13:54)</a>:</h4>
<p>I'd intuitively (without any idea what I am talking about :P ) expect that compiler barriers around setjmp and longjmp should suffice</p>



<a name="158801491"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/158801491" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#158801491">(Feb 18 2019 at 13:55)</a>:</h4>
<p>well there's probably a reason they are saying this, some transformations that would otherwise break stuff or so</p>



<a name="158801506"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/158801506" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#158801506">(Feb 18 2019 at 13:55)</a>:</h4>
<p><code>#[returns_twice]</code> elides certain optimizations, but not all of them</p>



<a name="158801507"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/158801507" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#158801507">(Feb 18 2019 at 13:55)</a>:</h4>
<p>i have one example, sec:</p>



<a name="158801609"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/158801609" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#158801609">(Feb 18 2019 at 13:57)</a>:</h4>
<p>This is UB even if <code>setjmp</code> is <code>returns_twice</code>:</p>
<div class="codehilite"><pre><span></span><span class="k">unsafe</span><span class="w"> </span><span class="k">fn</span> <span class="nf">foo</span><span class="p">()</span><span class="w"> </span>-&gt; <span class="kt">i32</span> <span class="p">{</span><span class="w"></span>
<span class="w">    </span><span class="kd">let</span><span class="w"> </span><span class="k">mut</span><span class="w"> </span><span class="n">buf</span>: <span class="nc">jmp_buf</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="p">[</span><span class="mi">0</span><span class="p">;</span><span class="w"> </span><span class="mi">8</span><span class="p">];</span><span class="w"></span>
<span class="w">    </span><span class="kd">let</span><span class="w"> </span><span class="k">mut</span><span class="w"> </span><span class="n">x</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="mi">42</span><span class="p">;</span><span class="w"></span>
<span class="w">    </span><span class="k">if</span><span class="w"> </span><span class="n">setjmp</span><span class="p">(</span><span class="o">&amp;</span><span class="k">mut</span><span class="w"> </span><span class="n">buf</span><span class="p">)</span><span class="w"> </span><span class="o">!=</span><span class="w"> </span><span class="mi">0</span><span class="w"> </span><span class="p">{</span><span class="w">  </span><span class="c1">// Step 0: setjmp returns 0</span>
<span class="w">        </span><span class="c1">// Step 3: when setjmp returns 1 x has always been</span>
<span class="w">        </span><span class="c1">// modified to be  == 13 so this should always return 13:</span>
<span class="w">        </span><span class="k">return</span><span class="w"> </span><span class="n">x</span><span class="p">;</span><span class="w"></span>
<span class="w">    </span><span class="p">}</span><span class="w"></span>
<span class="w">    </span><span class="n">x</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="mi">13</span><span class="p">;</span><span class="w"> </span><span class="c1">// Step 1: x is modified</span>
<span class="w">    </span><span class="n">longjmp</span><span class="p">(</span><span class="o">&amp;</span><span class="k">mut</span><span class="w"> </span><span class="n">buf</span><span class="p">,</span><span class="w"> </span><span class="mi">1</span><span class="p">);</span><span class="w"> </span><span class="c1">// Step 2: jumps to Step 0 returning 1</span>
<span class="w">    </span><span class="n">x</span><span class="w"> </span><span class="c1">// this will never be reached</span>
<span class="p">}</span><span class="w"></span>
</pre></div>



<a name="158801850"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/158801850" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#158801850">(Feb 18 2019 at 14:00)</a>:</h4>
<p>That's because: <a href="http://port70.net/~nsz/c/c11/n1570.html#7.13.2.1p3" target="_blank" title="http://port70.net/~nsz/c/c11/n1570.html#7.13.2.1p3">http://port70.net/~nsz/c/c11/n1570.html#7.13.2.1p3</a></p>



<a name="158801988"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/158801988" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#158801988">(Feb 18 2019 at 14:03)</a>:</h4>
<p>Basically, <code>longjmp</code> states that, because <code>x</code> was modified between the <code>setjmp</code> and the <code>longjmp</code>, the behavior of performing a non-volatile read of it is undefined.</p>



<a name="158802242"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/158802242" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#158802242">(Feb 18 2019 at 14:07)</a>:</h4>
<p>We could allow that in Rust, but the API docs of the C FFI function would still say that this is UB.</p>



<a name="158802454"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/158802454" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#158802454">(Feb 18 2019 at 14:10)</a>:</h4>
<p>so the problem is the compiler will move the store to after the <code>longjmp</code>?</p>



<a name="158802482"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/158802482" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#158802482">(Feb 18 2019 at 14:11)</a>:</h4>
<p>hm, I see... compiler barriers don't help because of the "did the address escape" analysis compilers are doing.</p>



<a name="158802486"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/158802486" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#158802486">(Feb 18 2019 at 14:11)</a>:</h4>
<p>that analysis is cause so much trouble :(</p>



<a name="158802490"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/158802490" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#158802490">(Feb 18 2019 at 14:11)</a>:</h4>
<p>the problem is that the compiler might const propagate x = 42 to return x because it assumes that if some code changed it, the user needs to perform a volatile read, but it is not doing that here</p>



<a name="158802571"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/158802571" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#158802571">(Feb 18 2019 at 14:12)</a>:</h4>
<p>basically, LLVM <code>returns_twice</code> maps to C's semantics, where if a volatile read is not used, LLVM assumes that the value was not modified between the <code>setjmp</code> and the <code>longjmp</code>.</p>



<a name="158802621"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/158802621" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#158802621">(Feb 18 2019 at 14:13)</a>:</h4>
<p>the LLVM <code>returns_twice</code> attribute disables other optimizations, but not this one</p>



<a name="158802632"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/158802632" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#158802632">(Feb 18 2019 at 14:13)</a>:</h4>
<p>since for C, that optimization is correct</p>



<a name="158802692"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/158802692" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#158802692">(Feb 18 2019 at 14:14)</a>:</h4>
<p>(if the compiler cannot prove that the value was not modified, it would need to insert a volatile load)</p>



<a name="158805366"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/158805366" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nagisa <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#158805366">(Feb 18 2019 at 14:56)</a>:</h4>
<p>setjmp/longjmp = unsafe &amp; problems solved.</p>



<a name="158805371"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/158805371" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nagisa <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#158805371">(Feb 18 2019 at 14:56)</a>:</h4>
<p><span aria-label="slight smile" class="emoji emoji-1f642" role="img" title="slight smile">:slight_smile:</span></p>



<a name="158808231"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/158808231" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#158808231">(Feb 18 2019 at 15:38)</a>:</h4>
<p><span class="user-mention" data-user-id="120791">@RalfJ</span> so I was trying to add a summary comment of the discussion before modifying the RFC, and I am not sure I fully understood: <code>fn free_box_without_drop(x: Box&lt;T&gt;) { mem::forget(*x) }</code>. That function moves the content of the box out of the box into stack storage, then drops the empty Box, right? That's not the exact same thing as freeing the box without dropping its contents and without moving its contents into the stack.</p>



<a name="158808272"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/158808272" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#158808272">(Feb 18 2019 at 15:39)</a>:</h4>
<p>Is it possible to free the box memory without dropping its contents and without using extra stack memory in safe Rust? (that would be more similar to what non-local goto does). I am not sure if the difference matters though.</p>



<a name="158808396"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/158808396" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#158808396">(Feb 18 2019 at 15:41)</a>:</h4>
<blockquote>
<p><span class="user-mention silent" data-user-id="120791">@RalfJ</span> so I was trying to add a summary comment of the discussion before modifying the RFC, and I am not sure I fully understood: <code>fn free_box_without_drop(x: Box&lt;T&gt;) { mem::forget(*x) }</code>. That function moves the content of the box out of the box into stack storage, then drops the empty Box, right? That's not the exact same thing as freeing the box without dropping its contents and without moving its contents into the stack.</p>
</blockquote>
<p>the <code>memcpy</code> of the contents to the stack is not observable (ignoring stack overflow^^)</p>



<a name="158808401"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/158808401" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#158808401">(Feb 18 2019 at 15:41)</a>:</h4>
<p>so I'd argue this is exactly dropping the Box without dropping its contents</p>



<a name="158808411"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/158808411" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#158808411">(Feb 18 2019 at 15:41)</a>:</h4>
<p>actually I'd expect LLVM will optimize away the useless <code>memcpy</code></p>



<a name="158808605"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/158808605" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#158808605">(Feb 18 2019 at 15:44)</a>:</h4>
<p><span class="user-mention" data-user-id="120791">@RalfJ</span> i think the issue with the longjmp is that it takes ownership of all the stack frames</p>



<a name="158808632"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/158808632" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#158808632">(Feb 18 2019 at 15:45)</a>:</h4>
<p>moves them out, and frees them</p>



<a name="158808713"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/158808713" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#158808713">(Feb 18 2019 at 15:46)</a>:</h4>
<p>there's many ways to describe the same issue ;)</p>



<a name="158808723"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/158808723" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#158808723">(Feb 18 2019 at 15:46)</a>:</h4>
<p>but you can't move a <code>Pin</code> (that's the whole point), so the problem with longjmp is a move of a <code>!Move</code> type, or however we would express <code>Pin</code> in the type system if we could</p>



<a name="158808812"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/158808812" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#158808812">(Feb 18 2019 at 15:48)</a>:</h4>
<p>that is, even though Rust does not have <code>Move</code> (or <code>!Move</code>), by blessing <code>Pin</code>, we have actually added them to the language</p>



<a name="158809351"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/158809351" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#158809351">(Feb 18 2019 at 15:56)</a>:</h4>
<p>So this is what I've wrote as summarizing comment. I don't know if there is a more succinct or clear way to put this.</p>
<hr>
<p>The RFC is incorrect, because deallocating memory without calling destructors is ok in safe Rust, e.g., <code>fn free_box_without_drop(x: Box&lt;T&gt;) { mem::forget(*x) }</code>.</p>
<p>Notice how, to deallocate the Box without dropping its contents, you have to move the contents of the box out first. </p>
<p>The issue triggered by non-local goto's and <code>Pin</code>, is deallocating pinned memory. Doing that would require moving the object out of the <code>Pin</code> first, forgetting it to avoid running destructors, and then deallocating the memory, but one cannot move out of a <code>Pin</code>. </p>
<p>So what non-local goto can introduce, is a move out of a "<code>!Move</code>" type, which violates the type-system invariants, and is undefined behavior.</p>



<a name="158821782"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/158821782" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#158821782">(Feb 18 2019 at 19:04)</a>:</h4>
<p>that's not wrong, but IMO you are mixing up cause an effect here</p>



<a name="158821826"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/158821826" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#158821826">(Feb 18 2019 at 19:05)</a>:</h4>
<p>really what we have added to the language by blessing <code>Pin</code> is that you cant just deallocate stuff, even if you are never going to look at it again</p>



<a name="158821837"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/158821837" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#158821837">(Feb 18 2019 at 19:05)</a>:</h4>
<p>in the general case, you might have to "ask for permission"</p>



<a name="158821839"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/158821839" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#158821839">(Feb 18 2019 at 19:05)</a>:</h4>
<p>I wouldn't call that <code>!Move</code></p>



<a name="158821884"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/158821884" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#158821884">(Feb 18 2019 at 19:06)</a>:</h4>
<p>but it does have somewhat similar effects, I agree with that</p>



<a name="165165288"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/165165288" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#165165288">(May 08 2019 at 13:59)</a>:</h4>
<p><span class="user-mention" data-user-id="210267">@Nemo157</span> pointed out that deallocating a <code>Pin</code> without calling its destructor is not unsafe, because a <code>Pin</code> can only contain a reference to the value being allocated, but it cannot contain the value itself in line. So if the <code>Pin</code> is freed, that's ok, because no other code can have references to that Pin, only to the value it refers to, and that value would have been leaked.</p>



<a name="165165395"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/165165395" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#165165395">(May 08 2019 at 14:00)</a>:</h4>
<p>e.g. if you have a <code>Pin&lt;Box&lt;T&gt;&gt;</code> jumping over the pin frees the Box memory, but does not free the memory the Box refers to</p>



<a name="165165562"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/165165562" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#165165562">(May 08 2019 at 14:03)</a>:</h4>
<p>the problem would be to have a that <code>Pin&lt;&amp;mut T&gt;</code> refers to a <code>T</code>, where the <code>T</code> is freed without calling its destructor (e.g. because the <code>T</code> is jumped over)</p>



<a name="165167470"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/165167470" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#165167470">(May 08 2019 at 14:26)</a>:</h4>
<blockquote>
<p>e.g. if you have a <code>Pin&lt;Box&lt;T&gt;&gt;</code> jumping over the pin frees the Box memory, but does not free the memory the Box refers to</p>
</blockquote>
<p>why would it free the Box memory? the destructor for all of this never gets called.</p>



<a name="165167621"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/165167621" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#165167621">(May 08 2019 at 14:28)</a>:</h4>
<p>i mean the memory of the Box value itself, not the memory it manages</p>



<a name="165169237"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/165169237" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#165169237">(May 08 2019 at 14:46)</a>:</h4>
<p>but then where is the problem? that's the same as doing <code>mem::forget</code> on a <code>Pin&lt;Box&lt;T&gt;&gt;</code></p>



<a name="165169649"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/165169649" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#165169649">(May 08 2019 at 14:51)</a>:</h4>
<p>no problem, just clarifying that the reason stack-pinning is unsafe with setjmp, is not because one can deallocate <code>Pin&lt;&amp;mut T&gt;</code> without calling <code>Pin</code>'s destructor, but because that <code>&amp;mut T</code> can refer to the stack, and that <code>T</code> can be deallocated without calling its destructor</p>



<a name="165169803"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/165169803" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#165169803">(May 08 2019 at 14:53)</a>:</h4>
<p>that is accurate</p>



<a name="165170022"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/165170022" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#165170022">(May 08 2019 at 14:55)</a>:</h4>
<p>i don't know if deallocating the storage for that <code>T</code> "moves it", which is what the Pin docs say should not happen, but it certainly invalidates any references to the type</p>



<a name="165170099"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/165170099" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#165170099">(May 08 2019 at 14:56)</a>:</h4>
<p>which is what the Pin docs might want to, at least, note</p>



<a name="165170114"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/165170114" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#165170114">(May 08 2019 at 14:56)</a>:</h4>
<p><a href="https://doc.rust-lang.org/nightly/std/pin/struct.Pin.html" target="_blank" title="https://doc.rust-lang.org/nightly/std/pin/struct.Pin.html">https://doc.rust-lang.org/nightly/std/pin/struct.Pin.html</a></p>



<a name="165170152"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/165170152" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#165170152">(May 08 2019 at 14:57)</a>:</h4>
<p><span class="user-mention" data-user-id="132920">@gnzlbg</span> <a href="https://doc.rust-lang.org/nightly/std/pin/index.html#drop-guarantee" target="_blank" title="https://doc.rust-lang.org/nightly/std/pin/index.html#drop-guarantee">https://doc.rust-lang.org/nightly/std/pin/index.html#drop-guarantee</a></p>



<a name="165170174"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/165170174" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#165170174">(May 08 2019 at 14:57)</a>:</h4>
<p>is there it talks about deallocating the storage</p>



<a name="165170185"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/165170185" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#165170185">(May 08 2019 at 14:57)</a>:</h4>
<p>lol, i've never seen that page</p>



<a name="165170198"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/165170198" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#165170198">(May 08 2019 at 14:57)</a>:</h4>
<p>I've always just looked at <code>pin::Pin</code> haha</p>



<a name="165170272"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/165170272" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#165170272">(May 08 2019 at 14:58)</a>:</h4>
<p>you have seen that the only thing it says there is "go to module docs please"?^^</p>



<a name="165170319"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/165170319" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#165170319">(May 08 2019 at 14:58)</a>:</h4>
<p>as someone who spent lots of time writing that particular doc, I'd appreciate feedback for making people actually go there ;)</p>



<a name="165170670"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/165170670" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#165170670">(May 08 2019 at 15:02)</a>:</h4>
<p>Make it bold</p>



<a name="165170684"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/165170684" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#165170684">(May 08 2019 at 15:02)</a>:</h4>
<p>and 20pt? :P</p>



<a name="165170694"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/165170694" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#165170694">(May 08 2019 at 15:02)</a>:</h4>
<p>I saw that, but I supposed that was just to show which other types are in the module or something</p>



<a name="165170705"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/165170705" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#165170705">(May 08 2019 at 15:02)</a>:</h4>
<p>i was totally wrong</p>



<a name="165170727"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/165170727" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#165170727">(May 08 2019 at 15:03)</a>:</h4>
<p>well played</p>



<a name="165170763"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/165170763" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#165170763">(May 08 2019 at 15:03)</a>:</h4>
<p>there's precedent for making it italic though: <a href="https://doc.rust-lang.org/nightly/std/primitive.i32.html" target="_blank" title="https://doc.rust-lang.org/nightly/std/primitive.i32.html">https://doc.rust-lang.org/nightly/std/primitive.i32.html</a></p>



<a name="165172623"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/165172623" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#165172623">(May 08 2019 at 15:23)</a>:</h4>
<p>Maybe one could add a <code>**Note**: the documentation for this types lives in the module documentation and not here</code> or something like that, that makes it more clear that this page is not what the type documentation is intended to be</p>



<a name="165172896"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/165172896" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#165172896">(May 08 2019 at 15:26)</a>:</h4>
<p>I disagree with the statement that this is how how it is "intended to be"</p>



<a name="165172905"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/165172905" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#165172905">(May 08 2019 at 15:26)</a>:</h4>
<p>pinning-the-concept != pin-the-type</p>



<a name="165172928"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/165172928" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#165172928">(May 08 2019 at 15:27)</a>:</h4>
<p>so module-level docs seem like the right place to me. that's why I put it there ;)</p>



<a name="165173067"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local%20goto%20and%20Pin%20/%20https%3A//github.com/rust-lang/rfc.../near/165173067" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/non-local.20goto.20and.20Pin.20.2F.20https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frfc.2E.2E.2E.html#165173067">(May 08 2019 at 15:28)</a>:</h4>
<p>i mean, the type documentation is intended to just be the "brief" comment that IDEs show (the first line), the actual documentation (about how to use the type, or the context in which the type is intended to be used) lives in the module</p>



<hr><p>Last updated: Aug 07 2021 at 22:04 UTC</p>
</html>